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Patent claims 

1- A method for monitoring the program execution in a 
microcomputer in an electronic appliance, particularly a sensor 
circuit for motor vehicles, where the program processes input 
data and generates output data, characterized in that in 
addition to the execution of the program a copy of the program, 
which is stored in a different address area than the program in 
the microcomputer, is executed with the input data intended for 
the program, and in that the output data from the copy are 
compared with those from the program and an error message is 
generated if they do not match. 

2. The method as claimed in claim 1, characterized in that 
further execution of the copy is provided which involves 
processing prescribed test data, in that the output data from 
the further execution of the copy are compared with comparative 
data stored in a memory, and in that an error message is 
generated if they do not match. 

3. The method as claimed in one of the preceding claims, 
characterized in that following the execution of the program 
and following the execution of program portions which are used 
to perform the inventive method a respective flag is set or 
changed, and in that an error message is generated if not all 
the flags have been set or changed. 

4. A method for monitoring the program execution in at least 
two interconnected microcomputers in an electronic appliance, 
particularly a sensor circuit for motor vehicles, characterized 
in that one of the microcomputers generates a request which is 
transmitted to the other microcomputer and 
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there uses prescribed input data to prompt the execution of a 
program, in that a response which is dependent on the output 
data is returned to the one microcomputer, and in that the one 
microcomputer compares the request and the response with one 
another . 

5. The method as claimed in claim 4, characterized in that 
the program is a copy of a program which performs the actual 
function of the other microcomputer. 

6. The method as claimed in either of claims 4 and 5, 
characterized in that the response is falsified from time to 
time, which the other microcomputer first of all identifies as 
an error in the one microcomputer, but which the one 
microcomputer expects and checks. 

7. The method as claimed in one of claims 4 to 6, 
characterized in that following the execution of the program 
and following the execution of program portions which are used 
for performing the inventive method a respective flag is set or 
changed, and in that an error message is generated if not all 
the flags have been set or changed. 

8. The method as claimed in claim 7, characterized in that 
the content of the flag register is falsified from time to 
time, which the other microcomputer first of all identifies as 
an error in the one microcomputer, but which the one 
microcomputer expects and checks. 

9. The method as claimed in one of claims 4 to 8, 
characterized in that an error counter in one of the 
microcomputers counts errors which have been detected for the 
respective other microcomputer, and in that if an incorrect 
response and/or a falsification in the flag register 
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is/are added then the counter 
that microcomputer in which 
falsification in the content 
added is not changed. 



reading of the error counter in 
the incorrect response or the 
of the flag register was/were 



